Attachment B- Performance Work Statement.pdf

ATTACHMENT B

PERFORMANCE WORK STATEMENT (PWS)

Customs Broker License Exam

For Remote Proctoring

Office of Trade

U.S. Customs and Border Protection (CBP)

Table of Contents Part 1: General Information

Part 2: Definitions & Acronyms

Part 3: Government Furnished Information

Part 4: Program Delivery Tasks

Part 5: Exam Administration Tasks

Part 6: Deliverables

Part 7: Quality Assurance Surveillance Plan

Part 8: Applicable Publications

Part 1: General Information

1 GENERAL INFORMATION:

This is a non-personal services contract to provide the Customs Broker License Exam

(CBLE) testing system and test administration services. The Government will not exercise any supervision or control over the service providers performing the services herein. Such service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to execute the CBLE as defined in this Performance

Work Statement (PWS) except for those items specified and Government furnished information (GFI). The Contractor shall perform to the standards in this PWS. The

Contractor shall deliver an online, remotely proctored exam delivery system, and administer the CBLE to include, but to not be limited to, the following services:

o Hosting the internet-based CBLE;

o Facilitating examinee registration;

o Checking-in examinees on the day of the CBLE;

o Remotely proctoring the CBLE over the internet;

o Providing appropriate technology and support for disability accommodations; and o Reporting out exam results and analysis.

1.2 Background: The CBLE is a semi-annual test, given for the last 50 years to license

Customs Brokers. Customs Brokers are people who are knowledgeable in Customs procedures and serve as agents for companies importing goods into the country. Customs

Brokers preliminarily classify and appraise imported goods, file entries, post bonds, and pay duties on behalf of the actual importer.

The Office of Trade (OT) within U.S. Customs and Border Protection (CBP) is the

Government office responsible for administering the CBLE. The specific responsibility is with the Broker Management Branch. In compliance with 19 Code of Federal Regulations

(CFR) § 111.13(a), the objective of the CBLE is to “determine the individual’s knowledge of Customs and related laws, regulations and procedures, bookkeeping, accounting, and all other appropriate matters, necessary to render valuable service to importers and exporters.”

By regulation, the exam is to be administered twice a year, on the fourth Wednesday in

April and in October, unless the regularly scheduled date conflicts with a national holiday, religious observance, or other foreseeable event and the agency publishes in the Federal

Register an appropriate notice of a change in the examination date. The agency expects to publish a notice of a change in the examination date for the April 2021 exam based on foreseeable conflicts. This notice will change the exam date from the fourth Wednesday in

April to be the third Wednesday in April (i.e., from April 28 to April 21, 2021). CBP will consult with the Contractor prior to publishing any change to the exam date in the Federal

Register.

CBP intends to transition to 100 percent remote proctoring through a phased approach, beginning with the April 2021 Exam. The first phase will entail administering the exam at in-person exam centers and through online remote proctoring for a limited number of registrants. The April 2021 exam will be the first CBLE administered with a remote proctoring option. In-person exam administration is a separate requirement not covered by this PWS. CBP will evaluate the user experiences of examinees measured via a survey, compare pass/fail rates to identify any statistically significant differences between exam delivery modalities, and assess frequency and severity of technical challenges in administering an online, remotely proctored exam. The second phase will entail transitioning to a 100 percent remotely proctored exam administration for the October 2021 exam. CBP may pursue additional technology enhancements, such as Artificial Intelligence assisted proctoring solutions, in subsequent phases.

1.3 Objectives: To secure a Contractor to deliver remotely proctored exam services and efficiently administer the CBLE within acceptable quality level parameters provided in this

PWS.

1.4 Scope: The Contractor shall administer the remotely proctored CBLE in accordance with the 19 CFR § 111.13. The Contractor shall provide resources required to administer the

CBLE in accordance with the specifications listed in this PWS. Providing in-person proctoring services is not included in the scope of this contract.

1.5 Ordering Period: The indefinite delivery, indefinite quantity contract will have an ordering period of five (5) years. CBP intends to issue a task order to cover preparation, examination, results transmission, and wrap-up for each semi-annual exam administration.

1.6 Quality Assurance Surveillance: The Government will evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance

Plan (QASP). This plan focuses on what the Government must do to ensure that the

Contractor has performed services in accordance with the performance standards. The

QASP describes how the performance standards included in the performance requirements summary are applied, the frequency of surveillance, and the minimum acceptable defect rate(s)/quality level(s). The QASP is included in Part 7 of this PWS.

1.7 Recognized Holidays: The Contractor is not required to perform services on the following holidays:

New Year’s Day Labor Day

Martin Luther King Jr.’s Birthday Columbus Day

Presidents’ Day Veterans Day

Memorial Day Thanksgiving Day

Independence Day Christmas Day

1.8 Place of Performance: If Government facilities are not available, other locations such as the

Contractor’s sites may be utilized for coordination and project planning activities at no additional cost to the Government. It is the Government’s intent to conduct coordination and project planning activities virtually to the greatest extent possible. The Contractor shall perform all other work at the Contractor site.

The address for the Office of Trade is:

U.S. Customs and Border Protection

Office of Trade

1331 Pennsylvania Ave NW

Washington, DC 20004

1.9 Type of Contract: Hybrid Firm-Fixed Price and Firm-Fixed Unit Price indefinite delivery, indefinite quantity contract.

1.9.1 Firm Fixed Price Tasks: The Contractor shall provide services under Part 4 of this

PWS on a Firm-Fixed Price basis for each order.

1.9.2 Firm Fixed Unit Price Tasks: The Contractor shall provide services under Part 5 of this PWS on a Firm-Fixed Unit Price basis for each order (i.e., per examinee). The number of examinees will be determined based on the Final Registration List provided to the Contractor two (2) business days prior to the exam. The

Government will not consider price adjustments based on qualified reasonable accommodations as determined by the Government, including examinees who receive additional time to complete the exam.

1.10 Contracting Officer Representative (COR): The COR will be identified by a separate letter.

The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions:

o assure that the Contractor performs the technical requirements of the contract;

o perform inspections necessary in connection with contract performance;

o maintain written and oral communications with the Contractor concerning technical aspects of the contract;

o issue written interpretations of technical requirements, including Government drawings, designs, specifications;

o monitor Contractor's performance and notify both the CO and Contractor of any deficiencies;

o coordinate availability of Government furnished information, and provide for

Contractor personnel supervised visitor access to Government facilities.

A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of an order or the contract.

1.11 Security Requirements: Contractor personnel will have access to sensitive but unclassified information. In lieu of CBP background investigations as outlined in HSAR 3052.204-

71(c), Contractor employees are required to execute a Non-Disclosure Agreement (NDA)

(Department of Homeland Security Form 11000-6) as a condition to access sensitive but unclassified information. The Contractor shall adhere to the Homeland Security

Acquisition Regulation (HSAR) special clauses Safeguarding of Sensitive Information

(MAR 2015), Information Technology Security Awareness and Privacy Training (MAR

2015), and Contractor Employee Access (HSAR 3052.204-71).

1.11.1 Physical Security: The Contractor shall safeguard all Government information and property provided for Contractor use. The Contractor shall maintain confidentiality of the CBLE contents and prevent unauthorized disclosure prior to administering the exam. The Contractor shall secure all Government materials at the close of each work period.

1.11.2 Personally Identifiable Information (PII): As part of the CBLE registration process, the prospective examinee registers on-line via cbp.gov, which directs the prospective examinee to pay.gov. The information entered via pay.gov as part of the registration includes Name, Address, Email, Social Security Number, Date of Birth, and payment information. The National Finance Center (NFC) transmits the records of all registrants in a password protected Excel sheet to OT. OT then provides the examinee’s name, email address, phone number, zip code, and a CBP provided unique identifier number to the Contractor in a password protected Excel spreadsheet. All files containing examinee information are password protected. The

Contractor requires the examinee name and email address in order to complete the registration process, check-in examinees on the day of the exam, and send the examinees their answer records after completing the exam. The Contractor requires the phone number to contact examinees in case of last minute exam notifications.

The Contractor shall verify the identity and proof of citizenship based on the following documents prior to the start of the exam:

CBP Approved Forms of Identification: U.S. Driver’s License, U.S. State Issued ID

Card, U.S. Passport, U.S. Military ID, U.S. Government Issued Visa, U.S. Territory

ID (Puerto Rico, Guam, etc.). In cases where the examinee has had a name change within the last six months, the Government will allow for an original marriage certificate or an original divorce decree or other similar original court order to be presented as proof of name change for verifying identification.

CBP Approved Proof of Citizenship: U.S. Passport, Birth Certificate, Certificate of

Naturalization, or Certificate of U.S. Citizenship, Official Military Service Award, or State, Federal or Local Government ID Card.

The Contractor shall not retain any sensitive PII beyond the minimal amount of time when it is no longer required during the performance of this contract. The Contractor shall not retain PII more than 90 days after the date of the exam. (Note: Considering that the Government provides the PII to the Contractor about 30 days prior to the day of the exam, the Contractor will not retain any PII for more than a total of 120 days).

The Contractor shall not retain any images or data obtained during check-in procedures prior to the start of exam after the Contractor has confirmed the identity and citizenship status of the examinee. The Contractor shall not retain video or images of the examinee unless it has received prior written approval from the

Contracting Officer. The Government will accept written reports from the Proctors notating any incidents. The Contracting Officer will not grant approval to retain video or images of the examinee without prior review and written approval from

CBP’s Office of Information and Technology and Privacy and Diversity Office.

1.11.3 System Security: All data that is provided to the Contractor as well as data collected by the Contractor shall be encrypted in transit and while at rest (see Section 4.2, Exam System Requirements). The Contractor shall:

a) Encrypt the database, system, files, and all data using an Advanced

Encryption Standard (AES) 256-Bit encryption;

b) Conduct monthly vulnerability scans on the systems housing the CBLE data in accordance with National Institute of Standards and Technology (NIST)

Special Publication 800-53 and provide CBP the results of these scans for

Government review;

c) Ensure security patches are installed within 15 calendar days of the software developer making the security updates available;

d) Maintain records of all security updates for the duration of the contract;

e) Ensure all personnel with access to the CBLE data and registrant PII complete the Privacy Training no later than four (4) weeks prior to the exam. The required privacy training is available at the following link:

https://www.dhs.gov/dhs-security-and-training-requirements-Contractors;

f) Provide certificate of completion of Privacy Training to the COR no later than four (4) weeks prior to the exam;

g) Delete all CBLE data including, but not limited to, examinee PII , check-in verification data (if retention approved per section 1.11.2), and all other data captured during the administration of the exam not later than 90 calendar days after the day of the exam; and

h) Provide a Certificate of Destruction, signed by the Contractor’s Chief

Technology Officer or equivalent, to the COR within 5 calendar days of purging the data and no later than 95 calendar days from administering the

CBLE.

1.12 Special Qualifications: The Contractor shall train and certify proctors for CBLE administration (see section 4.1.7). All Contractor personnel who may encounter CBP protected data or PII must undergo a criminal background investigation and complete required privacy awareness training. The required privacy awareness course is available on this website: http://www.dhs.gov/dhs-security-and-training-requirements-Contractors.

1.13 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or COR in accordance with

Federal Acquisition Regulation (FAR) Subpart 42.5. The Contracting Officer (CO), COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings the CO or COR will apprise the

Contractor of how the Government views the Contractor's performance and the Contractor https://www.dhs.gov/dhs-security-and-training-requirements-contractors http://www.dhs.gov/dhs-security-and-training-requirements-contractors will apprise the Government of problems, if any, being experienced. The Contractor shall take appropriate action to resolve outstanding issues. The Contractor shall participate in these meetings at no additional cost to the Government.

1.14 Key Personnel: The Government considers personnel performing any of the functions described below to be key personnel. Key personnel are personnel who are integral and indispensable in completing a contract. Key personnel shall be available at contract/project start, with the exception of the Contractor's lead resource (Program or Project Manager), who shall be available immediately after award. The Government does not intend to dictate the composition of the ideal team to perform this work, and encourages the

Contractor to form its team with any additional key personnel it determines as necessary for successful performance, identified by name and job title . The Contractor shall provide the names and contact information for Contractor’s lead resource and an alternate to the

CO and COR. The Contractor’s lead resource or alternate shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract. The lead resource or alternate shall be available between 8:00am and 5:00pm Eastern Time, Monday through Friday except Federal holidays or when the Government facility is closed for administrative reasons. The Contractor shall provide qualified personnel to perform all requirements specified in this PWS. Key Personnel shall be assigned for the duration of the contract and substituted only with CBP approval per HSAR 3052.215-70. The functions performed by key personnel are listed below:

a) Performs oversight and management of contracted services and related operations including managing multiple projects, tasks, resources and personnel.

b) Provides business and/or technical analysis in support of program or project. This may include completing project estimates, designing and completing status reports, providing necessary research, planning, managing tasks, creating and reviewing deliverables, managing communication and development of communication, preparing and delivering presentations, and interacting with project management and client.

c) Assigns resources, performs risk management, ensures adherence to plans and schedules, monitors contract/project performance and communicates at the senior level with the client on program status.

d) Provides consulting support in the areas of strategic workforce planning, human capital consulting, decision support and analytics, and workforce development or a related functional business field.

e) Contributes to research and exam design activities.

f) Applies technical and analytical approaches to address client issues related to process assessment, strategy and change management for process improvement, organizational transformation, and/or other related areas.

g) Provides facilitation and decision support collaboration with the client in an efficient, friendly, and positive manner.

1.15 Ancillary Support: Contractor shall provide any support necessary for the successful completion of the PWS requirements, to include any support item required.

1.16 Organizational Conflict of Interest: The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that there may be an actual or potential

Organizational Conflict of Interest (OCI) based on the work it is performing and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The

Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the

OCI.

Part 2: Definitions & Acronyms

2 DEFINITIONS & ACRONYMS:

2.1 Definitions:

ANSWER RECORD. A list of the question number and the corresponding answer selected by the examinee for all 80 questions of the Customs Broker License Exam.

ANSWER KEY. The list of 80 correct answers that corresponds to the 80 questions the

Government provides to the Contractor for each exam cycle.

CONTRACTING OFFICER (CO). A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the

Government. Note: The only individual who can legally bind the Government within the scope of the person’s authority.

CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S.

Government appointed by the CO to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does

NOT have authority to change the terms and conditions of the contractor or any task order issued thereunder.

DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

FAILURE. Technological or customer service shortfall that does not perform intended function, including defective services.

KEY PERSONNEL. Key personnel are personnel who are integral and indispensable in completing a task order and perform any of the functions listed in section 1.14.

PERSONALLY IDENTIFIABLE INFORMATION (PII). Means any information that permits the identity of an individual to be directly or indirectly inferred, including other information that is linked or linkable to an individual. For example, when linked or linkable to an individual, such information includes a name, social security number, date and place of birth, mother’s maiden name, account number, license number, vehicle identifier number, license plate number, device identifier or serial number, internet protocol address, biometric identifier

(e.g., photograph, fingerprint, iris scan, voice print), educational information, financial information, medical information, criminal or employment information, information created specifically to identify or authenticate an individual (e.g., a random generated number).

QUALITY ASSURANCE (QA). Procedures to verify that services being performed by the

Contractor are performed according to acceptable standards.

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP). An organized written document specifying the surveillance methodology used for surveillance of Contractor performance.

QUALITY CONTROL. All necessary measures taken by the Contractor to validate the quality of an end product or that service meets the contract requirements.

SENSITIVE PERSONALLY IDENTIFIABLE INFORMATION (SENSITIVE PII) means PII which, if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an Individual. Some types of PII, such as Social Security Number (SSNs), Alien Registration Number, and biometric identifiers, are always sensitive. Other types of PII, such as an individual’s driver’s license number, financial account number, citizenship or immigration status, or medical information are Sensitive PII if

DHS maintains them in conjunction with other identifying information about the Individual.

In some instances the context surrounding the PII may determine whether it is sensitive. For example, a list of employee names by itself may not be Sensitive PII, but could be if it is a list of employees who received poor performance ratings.

2.2 Acronyms:

ADA Americans with Disabilities Act

AES Advance Encryption System

AQL Acceptable Quality Level

ATP Acceptance Test Plan

CBLE Customs Broker License Exam

CBP U.S. Customs and Border Protection

CFR Code of Federal Regulations

CO Contracting Officer

COR Contracting Officer’s Representative

CPARS Contractor Performance Assessment Reporting System

D.C. District of Columbia

DHS Department of Homeland Security

FAR Federal Acquisition Regulation

GFI Government Furnished Information

HSAR Homeland Security Acquisition Regulation

NDA Non-Disclosure Agreement

NFC National Finance Center

NIST National Institute of Standards and Technology

NLT No Later Than

NW North West

OCI Organizational Conflict of Interest

OT Office of Trade

PII Personally Identifiable Information

PIN Personal Identification Numbers

POC Point of Contact

PCII Protected Critical Infrastructure Information

PWS Performance Work Statement

QA Quality Assurance

QASP Quality Assurance Surveillance Plan

QC Quality Control

QACP Quality Assurance and Control Program

SAT System Acceptance Test

SOC Security Operations Center

SPII Sensitive Personally Identifiable Information

SSI Sensitive Security Information

SSN Social Security Number

URL Uniform Resource Locator

Part 3: Government Furnished Information

3 GOVERNMENT FURNISHED INFORMATION:

The Government will provide the following information:

a) Historical testing site data (see Attachment C the solicitation);

b) The website link for the five (5) reference documents to be electronically available to the examinees to access during the test, which CBP will provide 12 weeks prior to the date of each exam;

c) The CBLE questions and answer key for each exam cycle, which CBP will provide eight

(8) weeks prior to the date of each exam;

d) Post-exam survey questions, which CBP will provide eight (8) weeks prior to the date of each exam;

e) The list of people registered to take the CBLE, including the names, emails, and CBP-provided unique identifier number for each registrant, which CBP will provide 25 calendar days prior to the date of each exam; and

f) The list of registrants that withdraw their registration for participating in the exam, which

CBP will provide eight (8) business days prior to the exam and again two (2) business days prior to the date of each exam.

Part 4: Program Delivery Tasks (Firm-Fixed Price)

4 PROGRAM DELIVERY TASKS:

The following table describes the program’s milestones.

Timing Milestone GFI/E

At time of Award Exam Event Planning begins

1 week after receipt of order

The Contractor provides signed NDAs to COR

2 weeks after receipt of order

The Contractor provides Kick-off meeting

Monthly The Contractor shall run vulnerability scans on all systems that are used to process and retain CBLE data; and provide a copy of the vulnerability scans to the COR the first Tuesday of each month for the

Government to review

14 weeks prior to exam The Contractor provides web address (i.e., Uniform

Resource Locator (URL) link for user configuration and compatibility test; The Contractor provides

Acceptance Test Plan (ATP) for practice CBLE for

Government review and approval

12 weeks prior to exam The Government provides the five (5) exam reference links to the Contractor to be incorporated into the testing system

Y

10 weeks prior to exam The Contractor provides web address (i.e., URL link) for Government acceptance of the Contractor-developed Practice CBLE for public use

8 weeks prior to exam The Contractor provides ATP for the CBLE Exam

System for Government review and approval

8 weeks prior to exam The Government provides the CBLE questions, answer key, and post-exam survey questions

Y

6 weeks prior to exam Registrant application begins (Government function) Y

4 weeks prior to exam DHS Privacy Training is completed by all employees with access to CBLE data and examinee

PII and certificates of completion are provided to

COR.

4 weeks prior to exam The Contractor delivers the remote proctoring CBLE

Exam System after completion of internal testing for

Government acceptance

NLT 25 calendar days prior to exam

The Government provides the Contractor with the

List of Registrants for the remotely proctored CBLE

Y

NLT 24 calendar days prior to exam

The Contractor contacts registrants via email with instructions for preparing for remotely proctored exam (including procedures for compatibility check)

NLT 3 weeks prior to exam

The Contractor begins training Proctors

2 weeks prior to exam The Contractor provides Proctor certifications and

NDAs to COR; the Contractor finalizes reasonable accommodations for ADA registrants

NLT 8 days prior to exam

The Government provides known registrant cancellations.

Y

7 business days prior to exam

The Contractor issues admission tickets to registrants (including system check instructions)

2 business days prior to

The Government provides report of registration cancellations to Contractor as the Final Registrant

List

Y

Exam day The Contractor administers the CBLE

1 business day after exam

The Contractor provides Preliminary Pass Rate, Exam no-shows, and After Exam Geographic

Reports

3 business days after

The Contractor provides exam reports (Exam Item

Analysis Report, Score Report, Survey Data Report, and Individual Answer Records)

4 weeks after exam The COR provides post-exam feedback and recommendations for next CBLE

Y

90 days after exam The Contractor shall delete all CBLE data including, but not limited to, examinee PII, exam recordings, and check-in verification data

95 days after exam The Contractor shall provide a Certificate of

Destruction, signed by the Contractor’s Chief

Technology Officer or equivalent, to the COR within

5 calendar days of purging the data and no later than

95 calendar days from administering the CBLE

2 months prior to end of the final task order period of performance

The Contractor provides Transition Out Plan

4.1 Program Management Requirements

4.1.1 The Contractor shall provide a contract kick-off meeting with the Government within two (2) weeks of award of contract.

4.1.2 The Contractor shall meet weekly with the Government to discuss progress and timeline goals and provide a weekly meeting agenda to the Government one (1) business day prior to the meeting.

4.1.3 The Contractor will provide meeting notes covering the major topics and all action items for all meetings no later than two (2) business days after the meeting. Note:

This includes the kick-off meeting, weekly meetings, and all other meetings between the Contractor and Government.

4.1.4 All Contractor staff assigned to the CBLE program, including proctors, shall sign a

Non-Disclosure Agreement (NDA) form and maintain the strictest confidentiality of the content of the CBLE. The Contractor shall submit signed NDAs to the COR

NLT one (1) week after task order award for all assigned staff with access to CBP information. The Contractor shall submit NDAs for all proctors to the COR along with training certifications NLT two (2) weeks before the exam.

4.1.5 All Contractor staff assigned to the CBLE program, including proctors, who may have access to the CBLE data and registrant PII shall complete the Privacy Training no later than four (4) weeks prior to the exam. The required privacy training available at the following link: https://www.dhs.gov/dhs-security-and-training-requirements-Contractors. The Contractor shall provide certificate of completion of

Privacy Training to the COR no later than four (4) weeks prior to the exam.

4.1.6 The Contractor shall maintain confidentiality of the CBLE contents and prevent unauthorized disclosure.

4.1.7 The Contractor shall begin training and certifying proctors for CBLE-specific administration requirements no later than three (3) weeks prior to the CBLE. The

Contractor shall ensure all proctors completed required privacy training available at the following link: https://www.dhs.gov/dhs-security-and-training-requirements-

Contractors. The Contractor shall provide a list of trained proctors and training completion dates to the COR NLT two (2) weeks prior to the exam.

4.1.8 The Contractor shall communicate any issues that arise in a timely and transparent manner, whether technological or logistical, with the Government and implement solutions to the Government’s satisfaction.

4.1.9 The Contractor shall identify potential risks and issues, the associated impacts, and the proposed risk management strategy, including risk monitoring and implementation of mitigation, avoidance, or acceptance plans.

4.1.10 The Contractor shall provide change management controls, monitor and communicate changes to the Government.

4.1.11 The Contractor shall provide a virtual War Room for the Contractor and

Government to maintain operational awareness of the administration of the exam and to resolve issues as they arise. The War Room shall provide a means for real time communication and facilitate final decision making for proctor and registrant issues on exam day (e.g., registrant check-in verification issues, cheating, resolving administrative uncertainties).

4.1.12 The Contractor shall notify the War Room immediately of any examinee caught cheating on the CBLE and document the incident on the After Exam Proctor Group

Report.

https://www.dhs.gov/dhs-security-and-training-requirements-contractors https://www.dhs.gov/dhs-security-and-training-requirements-contractors

4.1.13 The Contractor shall provide sufficient resources and technology to administer the exam for all exam registrants.

4.1.14 Proctors must be US citizens, must be located in the United States, and must have undergone a criminal background investigation.

4.1.15 The Contractor shall deliver the following exam administration reports within one

(1) business day following the CBLE:

a) Exam No-Shows Report: Provides detailed list of registered examinees who did not participate or complete the CBLE, including registered city, state, and zip code and examinee unique identification number.

b) After Exam Proctor Reports: Provides summary status of the proctor group, describes ADA accommodations and any issues experienced in each proctor group such as cheating and disruptions.

c) Preliminary Pass Rate Report: Provides the preliminary overall pass rate to

CBP prior to conducting further analysis.

4.1.16 The Contractor shall perform an item analysis of each answer by question and deliver an initial exam item analysis report no later than three (3) business days after the exam (see section 4.1.17.a).

a) The Government will provide guidance if any questions should be eliminated from the exam for scoring purposes two (2) business days after receipt of

Contractor-provided item analysis.

b) The Contractor shall revise the previous item analysis and calculations based on the Government’s determination to eliminate any exam questions for scoring purposes, provide credit for additional answers, or make other modifications and provide an updated and finalized item analysis to the

Government three (3) business days after the Contractor has received input from the Government.

4.1.17 The Contractor shall submit the following exam reports within three (3) business days following the submission of the finalized item analysis to the COR:

a) Exam Item Analysis Report: Provide overall item response data broken down by question number that provides frequency of chosen item response and overall percent correct. The Contractor shall provide a revised exam item analysis report in the event of answer key changes.

b) Geographic (Ports of Entry) Score Report: Provide exam data summary reports by Ports of Entry for the number of examinees, the number and percentage of passing exams, and number and percentage of correct answers for each question. The Port of Entry associated with each examinee may be provided by

CBP as part of the registration data or captured through a mandatory-response post-exam survey item.

c) Survey Data Report: Consists of data collected from post-exam survey questions provided by the Government. The Contractor shall provide complete survey question response data (including unique identifier, Port of Entry, and zip code), and summary statistics for survey question, including the overall frequency of each selected answer choice and by Port of Entry.

d) Raw Data Report: Includes all data collected and a coded answer key in an

Excel spreadsheet file.

e) Individual Answer Records: Provides electronic copy of each examinee’s answer record that the Contractor provided to the examinee on the day of the exam. Each examinee’s record shall be saved in an individual file according to the following naming convention: “Lastname_Firstname_UniqueIdentifier.pdf”

4.1.18 The Contractor shall provide a Transition Out Plan for the program, to include documentation of current practices, policies and procedures to be transferred to the

Government for the successful continuation of the work. The Contractor shall submit the Transition Out Plan 60 calendar days prior to the end of the final task order period of performance. At a minimum, the Transition Out Plan shall address:

a) Potential problems and mitigation plans;

b) Transfer to incoming Contractor of assumption of full contract responsibilities;

c) Transferring of documentation and projects currently in progress; and

d) Documentation of all current work and processes.

4.2 Exam System Requirements

4.2.1 The Contractor shall define minimum system specifications for users (e.g.

bandwidth, hardware, software).

4.2.2 The Contractor shall provide system suitability test URL for registrants to evaluate system compliance and identify potential issues prior to, during, and after registration for CBLE (e.g., compatibility check for bandwidth, hardware, software).

4.2.3 The Contractor shall prepare and submit ATP detailing the inspections and tests required to verify and validate the performance of the Practice CBLE and the CBLE

Exam System prior to delivery and Government acceptance of those deliverables.

a) Practice CBLE ATP: The Contractor shall deliver the ATP for the Practice

CBLE to the Government for review and approval 14 weeks prior to the April

2021 exam. The Contractor shall include a checklist of all inspections and tests necessary to ensure that the system under test conforms to the latest approved configuration and to validate and verify compliance with system requirements.

b) CBLE Exam System ATP: The Contractor shall deliver the ATP for the CBLE

Exam System to the Government for review and approval 8 weeks prior to the exam. The Contractor shall include a checklist of all inspections and tests necessary to ensure that the system under test conforms to the latest approved configuration and to validate and verify compliance with system requirements.

4.2.4 The Contractor shall conduct verification and validation testing of the system under test in accordance with the ATP to ensure the system meets all performance requirements and user functions as specified in the PWS, including simulated network performance based on peak user volumes and bandwidth degradation. The

Contractor shall complete internal testing prior to delivering the system to the

Government. The Government will conduct a System Acceptance Test (SAT) in accordance with the ATP for each system prior to acceptance. The Government will complete a SAT of the CBLE Exam System prior to each exam and for any changes made to the Practice CBLE. Expenses incurred by the Contractor to make any modifications required to pass a Government SAT are the responsibility of the

Contractor.

4.2.5 The Contractor shall provide the web address (i.e., URL link) for the Practice

CBLE to the COR NLT 10 weeks prior to the April 2021 exam for Government acceptance. The Practice CBLE will be publicly available and accessible from a link posted on the CBP.gov website for exam practice and familiarization. The

Practice CBLE shall include a complete set of prior year CBLE exam questions as provided by CBP and shall have the same look and function of the exam delivery system that examinees will use on the day of the exam (see section 4.2.7).

4.2.6 The Contractor shall provide the web address (i.e., URL link) for the final copy of

CBLE Exam System that the Contractor will use to administer the CBLE NLT four

(4) weeks prior to the exam for Government acceptance.

4.2.7 The CBLE Exam System shall:

a) Be responsive without noticeable loading or time lag in displaying information after input from the system user based on minimum system specifications;

b) Display only one (1) question and associated answer choices per screen;

c) Save every answer entry upon proceeding to another screen;

d) Enable users to return to a previous screen in case of intermittent loss of connectivity;

e) Monitor and display elapsed time after the system user begins the CBLE;

f) Restrict ability to save or change answers after 4 hours and 30 minutes have elapsed;

g) Allow users to view an Answer Record page at any point during the exam, which includes: a numbered list (1 through 80) with the corresponding selected answer (A through E) and display “No Answer Was Provided” in the case of an unanswered question;

h) Allow users to skip questions, return to previous questions, and change previously answered questions;

i) Provide an electronic standard calculator for examinees to use (i.e., no additional functions beyond what is available in standard setting for a

Windows 10 system calculator; and no fewer functions than the minimum add, subtract, multiply, and divide);

j) Provide an electronic basic note pad for examinees to use;

k) Allow users to highlight words within the questions with their mouse;

l) Allow users to access up to five (5) reference documents via separate URLs for each reference;

m) Disable Find (Control + F), Copy (Control + C), Cut (Control + X) and Paste

(Control + V) functions, including all clipboard menu options accessible by a user’s ‘right’ click via the mouse;

n) Display the Answer Record to the system user prior to the user being able to submit their final answers. *Note* No answer shall be final until the examinee has selected “submit” after reviewing the “Answer Record” page. This is a different requirement than above. This requirement is in reference to the last page of the test. The previous requirement related to the user being able to view the Answer Record at any point during the test;

o) Encrypt the database, system, files, and all data using an Advanced Encryption

Standard (AES) 256-Bit encryption for data in transit and while at rest;

p) Stream video and audio of each examinee for proctoring of the exam;

q) Not retain video, images, or audio of the examinee unless provided written

Authorization by CBP in accordance with Section 1.11.2;

r) Enable Proctors to maintain a log of events, anomalies, and suspected cheating within the individual proctor record;

s) Monitor and log key-strokes to assist in adjudicating appeals; and

t) Monitor and log access to applications and websites outside of the Exam

System environment and approved reference URLs.

The following System features are not among the Government’s minimum

System requirements, but, if included, will be considered to enhance the

System provided to the Government:

Use of a “lock-down browser” feature to prevent examinees from accessing unauthorized programs, applications, and websites, opening new tabs, and disabling specified key combinations.

4.2.8 The Contractor shall load the exam that CBP provides as GFI onto the CBLE Exam

System for each administration of the exam.

4.2.9 The Contractor shall deliver an exam system that accommodates ADA requests

(e.g., extra time to complete the exam, display/font sizes, etc).

4.2.10 The Contractor shall allow the Government full access to data captured during the administration of the exam.

4.2.11 The Contractor shall conduct monthly vulnerability scans on the systems housing the CBLE data in accordance with National Institute of Standards and Technology

(NIST) Special Publication 800-53 and provide CBP the results of these scans for

Government review.

4.2.12 The Contractor shall ensure security patches are installed within 15 calendar days of the software developer making the security updates available.

4.2.13 The Contractor shall maintain records of all security updates for the duration of the contract.

4.2.14 The Contractor shall delete all CBLE data including, but not limited to, examinee

PII, exam recordings (if approved per section 1.11.2), check-in verification data (if retention approved per section 1.11.2), and all other data captured during the administration of the exam not later than 90 calendar days after the day of the exam.

Reference Data Retention Table below.

Data Type Description Data Source Retention Period

Registration PII - examinee’s name, email address, phone number, zip code, and a CBP provided unique identifier number.

CBP Exam

Registration

Shall not retain more than 90 days after the date of the exam

Identity and Citizenship

Verification Data (including images and video)

Examinee Provided during Check-in

Procedures

Shall not retain for any amount of time (live stream only). If approval is granted per Section

1.11.2, then the retention period is not more than 90 days after the date of the exam.

Images and Video Live Exam

Proctoring

Shall not retain for any amount of time (live stream only). If approval is granted per Section

1.11.2, then the retention period is not more than 90 days after the date of the exam.

All additional registrant/examinee data – including answer records, contractor provided unique identifier number, etc

Contractor

Registration and

Exam System

Shall not retain more than 90 days after the date of the exam

4.2.15 The Contractor shall provide a Certificate of Destruction, signed by the

Contractor’s Chief Technology Officer or equivalent, to the COR within 5 calendar days after purging the data but no later than 95 calendar days after the date of the exam.

Part 5: Exam Administration Tasks

(Firm-Fixed Unit Price)

5 EXAM ADMINISTRATION TASKS

5.1 The Contractor shall provide sufficient resources to proctor and check-in examinees on the day of the exam on a Firm-Fixed Unit Price basis based on the Final Registration List provided two (2) business days prior to the exam.

5.2 The Contractor shall issue admission tickets to all registrants via email seven (7) business days prior to the exam. The admission ticket shall include the registrant’s name and unique identifier and the date, time, system compatibility-check procedures, and other administrative information for the day of exam. The Government will notify the Contractor of any additional registration cancellations two (2) business days prior to the exam.

5.3 The Contractor shall facilitate ADA requests, to include, but not be limited to, providing extra time to complete the exam, modifying display/font sizes, or other accommodations at no additional cost to the Government. The Government typically receives about 10 ADA requests per exam. The Contractor shall propose reasonable accommodations for

Government review. With Government agreement, the Contractor shall notify ADA registrants no later than two (2) weeks prior to the exam whether the Government approved the ADA request.

5.4 The Contractor shall check-in each examinee by verifying the unique identification number, identification, and U.S. citizenship or naturalization of each examinee. The

Contractor shall check-in all verified examinees who access the exam system prior to the

8:30 am local exam start time. The Contractor shall not retain any data collected during the check-in process unless approved per section 1.11.2.

a) The Contractor shall verify the Identification with the at least one of the following:

U.S. Driver’s License, U.S. State issued identification card, U.S. Passport, U.S.

Military identification, U.S. Government issued visa, or U.S. Territory identification

(Puerto Rico, Guam, etc.). In cases where the examinee has had a name change within the last six months, the Government will allow for an original marriage certificate or an original divorce decree or other similar original court order to be presented as proof of name change for verifying identification.

b) Citizenship is verified with the presentation of at least one of the following: U.S.

Passport, Birth Certificate, Certificate of Naturalization, or Certificate of U.S.

Citizenship, Official Military Service Award, or State, Federal or local Government identification card.

5.5 The Contractor shall complete all check-in activities so that all examinees begin the CBLE not later than 8:30 am local start time.

5.6 The Contractor shall provide one (1) proctor for every six (6) to 10 examinees.

5.7 The Contractor shall be quiet, respectful, and prevent examinees from cheating on the

CBLE by performing the following:

a) Ensure examinees are not accessing unapproved reference materials;

b) Ensure examinees do not use unapproved electronic devices (e.g., tablets, cell phones, or smart watches) during exam;

c) Dismiss any examinee caught cheating on the CBLE from the exam; and,

d) Provide direction when needed to the examinees.

5.8 The Contractor shall ensure each examinee is located in a quiet, self-contained room where no other exam or activity is conducted during the exam period, including the check-in process. A quiet, self-contained room is defined as a room where there is no noise or distractions considered unsatisfactory for a testing environment and is a room with four (4) permanent structured walls (no partitions) and a closed door.

5.9 The Contractor shall provide a 10-minute and a 1-minute warning announcement prior to the conclusion of the exam, provide friendly and Government approved closing remarks upon the conclusion of the exam and remain available for a few moments to provide assistance to examinees.

5.10 The Contractor shall email the “Answer Record” page to each examinee once the examinee completes the exam. Note: examinees who do not complete the exam do not need to receive an Answer Record.

Part 6: Deliverables

6 DELIVERABLES TABLE

The following table describes the program’s deliverables.

Deliverable Timing Delivery Requirement Deliver To PWS

Reference

Signed NDAs Staff NDAs due 1 week after award;

Proctor NDAs due

NLT 2 weeks prior to exam

PDF file, electronic delivery

COR 4.1.4

Meeting Minutes

(Kick-off, weekly, and other meetings)

Within 2 business days after Meeting

MS Word file, electronic delivery

COR and

Government

Program Office

4.1.3

Monthly

Vulnerability Scans

1st Tuesday of each month

Electronic Delivery COR 1.11.3.b and 4.2.11

Weekly

Coordination

Meeting Agenda

1 business day prior to meeting

MS Word or

PowerPoint file, electronic delivery

COR and

Government

Program Office

4.1.2

ATP for Practice

CBLE

14 weeks prior to the April 2021 exam

MS Word or Excel file, electronic delivery

COR 4.2.3.a

Practice CBLE for public exam practice

10 weeks prior to the April 2021 exam

Web address, electronic delivery

COR and

Government

Program Office

4.2.5

ATP for CBLE

Exam System

8 weeks prior to exam

MS Word file, electronic delivery

COR 4.2.3.b

Proctor Script for warning announcements and closing remarks

8 weeks prior to exam

MS Word file, electronic delivery

COR and

Government

Program Office

5.9

CBLE Exam

System

4 Weeks prior to exam

Web address, Electronic delivery

COR and

Government

Program Office

5.2.6

Contr…